Most small and midsize businesses know they should assess cybersecurity risk. The hard part is turning years of policies, agreements, insurance applications, security reports, Microsoft 365 settings, backup procedures, and employee knowledge into one accurate picture.
NIST has published an initial public draft showing how generative AI can help organizations analyze and report progress against the NIST Cybersecurity Framework 2.0. Special Publication 1353 describes three uses: reviewing governance, creating a draft Current State Profile, and building a draft Target State Profile.
AI can reduce the work required to organize evidence, map controls, identify gaps, and prepare reports. Qualified people must still verify what is true, test what operates, protect sensitive evidence, and decide what risk the business can accept.
The guide was released August 19, 2026 and is open for public comment through October 15, 2026. It is a draft guide—not a final standard or an automated certification method.
What is the NIST Cybersecurity Framework?
The NIST CSF is voluntary guidance for managing cybersecurity risk. It applies to organizations of any size or industry and gives leaders, providers, and technical teams a common language for desired outcomes.
Govern: Establish leadership, policies, responsibilities, risk strategy, oversight, and supply-chain expectations.
Identify: Understand assets, systems, data, business processes, vulnerabilities, and risks.
Protect: Apply safeguards such as access control, training, data security, platform security, and resilience.
Detect: Find and analyze abnormal activity and cybersecurity events.
Respond: Manage incidents, communications, containment, investigation, and mitigation.
Recover: Restore systems and operations, communicate with stakeholders, and improve after an incident.
NIST also publishes a Small Business Quick-Start Guide for small and midsize businesses, nonprofits, schools, and smaller government organizations with modest or no formal cybersecurity plans. The framework is not a product and does not prescribe one universal technology stack.
What NIST’s new AI guide proposes
NIST demonstrates how an organization can provide an approved AI tool with cybersecurity evidence and structured instructions, then use the output as a starting point. Its CO-STAR structure defines the business context, exact objective, writing style, tone, audience, and required response format.
A vague request to “review our cybersecurity” can produce a vague and unreliable answer. Structured instructions can require the system to use approved sources, reference evidence, avoid unsupported assumptions, identify missing information, and return repeatable results. Better prompts improve transparency; they do not guarantee accuracy.
Three practical applications
1. Review policies, responsibilities, and governance
AI can compare acceptable-use policies, incident plans, insurance applications, employee handbooks, vendor contracts, and backup procedures written by different parties at different times. It can flag former employees who still own responsibilities, missing multifactor-authentication language, unassigned recovery testing, weak after-hours escalation, and systems excluded from policy. A qualified reviewer must verify the source language, determine materiality, and speak with management.
2. Build a draft Current State Profile
AI can extract claims from policies, configuration exports, security reports, insurance applications, contracts, interviews, incident records, and recovery tests; group related evidence; map it to CSF outcomes; and flag silence or inconsistency. It can reduce initial review time, but an invoice is not proof that every intended device is protected and a policy is not proof that a control operates.
3. Build a draft Target State Profile
AI can compare current evidence with critical services, acceptable downtime, information sensitivity, legal and contractual requirements, budget, staffing, cloud dependencies, seasonal operations, and hurricane risks. It can suggest a draft target and sequence. People must determine feasibility, ownership, investment, operational impact, and final priorities.
Evidence needs clear status labels
A document saying backups are tested is not proof that the latest restoration worked. A license invoice is not proof that all intended devices are protected. A policy requiring MFA is not proof that every account is enrolled.
- Documented: a policy or procedure says the control should exist.
- Configured: technical evidence shows the control is enabled.
- Operating: logs, tickets, or observations show it is working.
- Tested: a controlled exercise demonstrates the expected result.
- Not verified: available evidence does not support a conclusion.
Without these distinctions, an AI system can turn written intentions into false assurance.
Why this matters in Southwest Florida
Many local organizations do not have a full-time governance, risk, and compliance team. Technology and evidence may be distributed among an employee, managed provider, software vendor, developer, insurance agent, franchisor, and several cloud platforms.
A medical office may combine HIPAA policies, EHR vendor documents, Microsoft 365 settings, endpoint reports, and insurance requirements. A restaurant may depend on point-of-sale, online ordering, payroll, cameras, delivery platforms, and corporate systems. Property managers may hold owner and tenant records, payment data, building access, and vendor documents. Nonprofits often combine limited staff with donor data, shared accounts, and grant requirements.
AI can create a first unified view for annual reviews, insurance renewals, acquisitions, provider transitions, compliance preparation, incident planning, continuity exercises, budgets, and leadership reporting. Local target states should account for hurricanes, evacuation, power loss, internet disruption, inaccessible offices, and providers operating outside the disaster area.
Assessment evidence is more sensitive than it looks
Source material can expose administrator roles, network diagrams, inventories, vulnerabilities, unpatched systems, backup architecture, insurance answers, incident histories, vendor accounts, IP addresses, hostnames, recovery weaknesses, security exceptions, and regulated information. It can also contain secrets that were accidentally included in an export.
Before uploading anything, verify that the AI service is authorized for the information and review retention, training, access, confidentiality, and security terms. An enterprise product may provide stronger protection than a consumer account, but the product name alone does not authorize every type of data.
Microsoft says prompts, responses, and Microsoft Graph data used by Microsoft 365 Copilot and protected Copilot Chat experiences are not used to train foundation models. That protection does not fix excessive SharePoint permissions, inappropriate prompt access, weak sensitivity labeling, or prohibited uploads.
Eight safeguards for AI-assisted reviews
1. Define the question and scope
State the company, locations, systems, time period, and CSF outcomes included. Identify exclusions so a Microsoft 365 review is not mistaken for a complete assessment of firewalls, point-of-sale systems, websites, or operational technology.
2. Use an approved AI environment
Document the product, account type, license, privacy terms, retention settings, access controls, and permitted data classifications. Employee access to a personal AI account does not make it approved.
3. Minimize and sanitize the inputs
Remove passwords, secret keys, session tokens, full personal records, medical details, banking information, payment-card data, and unnecessary identifiers. Work from secure copies rather than casually forwarding production records.
4. Preserve source identity and provenance
Point every conclusion to the supporting document, version, date, section, interview, report, or technical evidence. Clearly label AI mappings as proposed or human-validated.
5. Require the AI to identify uncertainty
Require explicit statuses such as not addressed or insufficient evidence. Record assumptions, conflicts, and issues that require interviews or technical validation.
6. Verify technical controls independently
Use current portal settings, device reports, logs, alert history, backup results, and controlled tests. Proposals, invoices, screenshots, and summaries do not prove complete coverage.
7. Require qualified human review
Cybersecurity, privacy, legal, insurance, operational, and executive reviewers may own different conclusions. Validate scope, inputs, assumptions, applicability, and outputs before decisions are made.
8. Protect and retire the assessment workspace
Limit access to prompts, uploads, outputs, and notes. Apply retention, remove temporary files, revoke shared links, and record the service, source versions, reviewers, approvals, and final disposition.
How AI can help
- Extract requirements from policies and contracts
- Map evidence to CSF 2.0 outcomes
- Compare written policy with technical and operational evidence
- Identify missing owners, dates, definitions, and escalation paths
- Detect contradictions among insurance, policy, and vendor records
- Group duplicate findings and summarize interviews
- Draft Current and Target State Profiles
- Create evidence requests and remediation backlogs
- Translate findings for executives and boards
- Compare new evidence with prior assessments and track progress
Where human judgment is required
People remain responsible for selecting the authorized tool, defining scope, confirming legal and contractual requirements, evaluating evidence, interviewing staff and providers, testing controls, determining business impact, setting risk tolerance, prioritizing investment, approving exceptions, deciding what stakeholders receive, and signing any attestation.
An AI tool may find that recovery testing is undocumented. It cannot decide how long a business can safely operate without its clinical, scheduling, payment, property-management, or ordering systems. It may map a policy to a CSF outcome, but it cannot observe whether employees share accounts or an after-hours provider answers the phone.
Fourteen questions to ask your provider
1Which NIST CSF outcomes are in scope for our review?
2Which evidence will support each conclusion?
3Will any of our information be processed by an AI system?
4Which AI product, account type, and license will be used?
5Are prompts, uploaded files, and outputs retained or used for training?
6Who can access the assessment workspace and results?
7Which information will be redacted or excluded?
8How will AI-generated statements be distinguished from verified findings?
9Who will validate technical configuration and operating evidence?
10Will the review test backups, alerting, containment, and recovery?
11How will unsupported assumptions and missing evidence be reported?
12Will findings identify an owner, priority, dependency, and target date?
13How will results connect to cyber insurance and business continuity?
14What records will be retained after the project, and for how long?
How Managed Intelligence Advisors can help
We help Southwest Florida organizations turn disconnected cybersecurity information into an evidence-based risk program. That includes defining scope, inventorying systems and dependencies, collecting evidence securely, setting AI information boundaries, reviewing Microsoft 365 and security controls, interviewing stakeholders, and creating verified Current and Target State Profiles.
We distinguish documented, configured, operating, tested, and unverified controls; compare policy, insurance, contract, and technical requirements; identify high-impact gaps; build a budget-aware roadmap; and connect cybersecurity planning with hurricane readiness and business continuity.
The objective is not the longest report or highest score. It is a defensible understanding of what the business depends on, which safeguards work, which claims remain unverified, and what should happen next.
Frequently asked questions
What is the NIST Cybersecurity Framework?
The NIST Cybersecurity Framework is voluntary guidance that helps organizations understand, prioritize, communicate, and manage cybersecurity risk. CSF 2.0 organizes outcomes into Govern, Identify, Protect, Detect, Respond, and Recover.
Can a small business use the NIST Cybersecurity Framework?
Yes. NIST publishes a Small Business Quick-Start Guide for small and midsize businesses, nonprofits, schools, and smaller government organizations, including those with modest or no formal cybersecurity plan.
How can AI help with a cybersecurity assessment?
AI can review approved documents, map evidence to CSF outcomes, identify inconsistencies and missing information, draft Current and Target State Profiles, and summarize findings for different audiences. Qualified people must verify the evidence and conclusions.
Can AI prove that a cybersecurity control is working?
Not by analyzing policy documents alone. Technical configuration, logs, coverage reports, interviews, tickets, and controlled testing may be needed to show that a control is configured, operating, and effective.
Is it safe to upload vulnerability reports and security policies to an AI tool?
Only after the organization approves the tool and the specific information. Review retention, training, confidentiality, access, and security terms; remove unnecessary sensitive data and secrets; restrict access; and apply an appropriate retention plan.
Does Microsoft 365 Copilot use business data to train foundation models?
Microsoft states that prompts, responses, and Microsoft Graph data used by Microsoft 365 Copilot and protected Copilot Chat experiences are not used to train foundation models. Organizations still need correct licensing, configuration, permissions, retention, and data-governance controls.
Can an AI-generated assessment be used as a compliance certification?
No. NIST says its use cases are illustrative and are not prescriptive assessment or assurance methodologies. Applicability, evidence, assumptions, legal obligations, and conclusions require qualified review.
How can Managed Intelligence Advisors help?
Managed Intelligence Advisors can scope the review, collect and validate evidence, create Current and Target State Profiles, assess Microsoft 365 and other controls, prioritize improvements, and connect cybersecurity planning with business continuity.
Sources
- NIST SP 1353: Quick-Start Guide for Using AI for CSF Analysis and Reporting
- NIST: Using AI for CSF 2.0 Analysis and Reporting
- NIST Cybersecurity Framework 2.0 Resource Center
- NIST CSF 2.0 Quick-Start Guides
- NIST SP 1300: Small Business Quick-Start Guide
- NIST Artificial Intelligence Risk Management Framework
- NIST AI RMF Generative AI Profile
- Microsoft Learn: Data, Privacy, and Security for Microsoft 365 Copilot
- Microsoft Learn: Copilot Chat Privacy and Protections